Camouflage Attack Detection Based on KMOD Kernel Function

The feature of UNIX command sequences is analyzed, and the user profile and camouflage attack detection technology based on OCSVM is proposed. OCSVM is an algorithm to deal with single value classification, while string kernel is a function to handle sequenced data. According to the feature of command sequence, two new string kernel functions are put forward by improving the general function. Experiments show that the detection method using string kernel based on OCSVM can achieve much higher detection accuracy comparing to the present camouflage attack detection methods.